Prompt Injection: Threats, Defenses, and a Practical Policy Flow

Prompt injection is OWASP's #1 LLM risk. The bug is simple: LLMs can't tell instructions from data. Everything in the context window looks the same to the model.

An attacker embeds instructions in user input, in documents the model reads, or in responses from external APIs — and the model follows them. Below is the threat surface, the defense layers that work in practice, and a policy flow you can build against.

Sections

• Threat surface (where injections come from)
• Defense layers (what works in practice)
• A practical policy flow (how to wire it up)
• What honest defense looks like
• Where Swiftward fits

Threat surface (where injections come from)

For AI agents, injection is not just a prompt problem. Anything the model reads can carry an attack: user messages, documents added to context, responses from external APIs. Five categories you must assume exist:

Defense layers (what works in practice)

No single layer stops everything. Cheap fast filters first, then ML classifiers, then containment that limits blast radius when detection fails. Ordered from input processing to runtime containment:

A practical policy flow (how to wire it up)

Six steps. Each one feeds the next. Maps directly to the defense layers above.

What honest defense looks like

Nobody is 100% proof against prompt injection. OWASP says it directly: LLMs have no built-in concept of "trusted prompt" — the application must impose trust boundaries.

The defensible claim is: reduce attack success rate, bound the blast radius, trace every decision.

Same model as traditional security. You don't claim your firewall stops 100% of attacks. You have layered defenses, you detect and respond, and you can show exactly what happened and why.

Where Swiftward fits

Swiftward is a universal rules layer for consequential decisions — AI safety, trust & safety, risk, compliance. Not another detector.

It sits between your systems and the outside world, orchestrating detection, scoring, and containment as declarative policy. Use built-in detection, call external guardrails like Prompt Guard or Prompt Shields, or combine both in the same rule. No code changes — YAML policy, versioned, with replay, shadow mode, and instant rollback.

• Built-in prompt injection detection — multi-layered: Unicode normalization, categorized regex patterns, known attack phrase matching (500+ phrases, 10+ languages), fuzzy matching
• Pluggable external detectors — call any ML model or guardrail service (Prompt Guard, Prompt Shields, your own classifier) as a signal in the same policy. Combine scores from multiple sources in one rule
• Configurable via YAML policy — thresholds, scoring weights, category amplifiers, failure behavior (fail-open/closed/heuristic)
• Containment as rules — tool allowlists, parameter bounds, rate limits, HITL gates, spend limits
• Full decision trace — every signal, score, rule match, and action logged per event. Replay any past decision to see exactly what happened and why
• Safe deployment — replay/backtesting re-runs historical events through new rules first. Then shadow mode tests against live traffic without enforcement. Instant rollback if something breaks
• On-prem — your data never leaves your infrastructure

A Swiftward policy for prompt injection detection:

signals:
  injection_scan:
    udf: llm/prompt_injection
    params:
      text: "{{ event.data.prompt_context }}"
      threshold: 0.5
      normalize: true
      motifs: true
      fuzzy: true
      ml_endpoint: "http://prompt-guard:8000"
      ml_on_failure: "heuristic"

rules:
  block_high_severity:
    all:
      - path: "signals.injection_scan.score"
        op: gte
        value: 0.8
    effects:
      verdict: rejected
      state_changes:
        set_labels: ["prompt_injection"]
        change_counters:
          blocked_injections: 1
      actions:
        - action: security_alert
          params:
            channel: "#ai-security"
            details: "{{ signals.injection_scan.categories }}"
      response:
        blocked: true
        reason: "Prompt injection detected"

  flag_for_review:
    all:
      - path: "signals.injection_scan.detected"
        op: eq
        value: true
    effects:
      verdict: flagged
      actions:
        - action: enqueue_hitl
          params:
            queue: "#ai-review"
            timeout: 15m
      response:
        held: true
        reason: "Suspicious input — pending review"

# If neither rule fires (score < 0.5), the event passes through normally.

trace_id:       tr_ai_20260218_014
policy_version: agent_guardrails_v3
duration:       19ms

SIGNALS COMPUTED
+ injection_scan (18ms, llm/prompt_injection)
  -> detected: true
  -> score: 0.82
  -> matches: [en_ignore_instructions, en_admin_mode, delim_system_bracket]
  -> categories:
     instruction_override: 0.9
     system_manipulation: 0.8
     suspicious_delimiters: 0.6
  -> motif_count: 4
  -> fuzzy_count: 1
  -> ml_score: 0.91
  -> normalized: true

RULES EVALUATED
[P100] block_high_severity      MATCHED  (score 0.82 >= 0.8)
[P50]  flag_for_review          SKIPPED  (higher verdict already set)

VERDICT: REJECTED
Source:  block_high_severity
Reason:  Prompt injection detected

STATE MUTATIONS
+ SET LABELS:      ["prompt_injection"]
+ CHANGE COUNTERS: blocked_injections += 1

ACTIONS EXECUTED
+ security_alert -> #ai-security (1ms, OK)